Recover data on WDC WD30EZRX-00DC0B0

[sebr]

Hello,
the drive (NTFS) suddenly started to slow down the computer heavily. Also there were continous entries in error log of windows that it cannot read from a device (hdd). So i hook it up to Linux and here is the SMART data.

Code:

ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x002f   196   194   051    Pre-fail  Always       -       7693
  3 Spin_Up_Time            0x0027   175   174   021    Pre-fail  Always       -       6250
  4 Start_Stop_Count        0x0032   100   100   000    Old_age   Always       -       294
  5 Reallocated_Sector_Ct   0x0033   200   200   140    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x002e   100   253   000    Old_age   Always       -       0
  9 Power_On_Hours          0x0032   075   074   000    Old_age   Always       -       18481
10 Spin_Retry_Count        0x0032   100   100   000    Old_age   Always       -       0
11 Calibration_Retry_Count 0x0032   100   253   000    Old_age   Always       -       0
12 Power_Cycle_Count       0x0032   100   100   000    Old_age   Always       -       73
192 Power-Off_Retract_Count 0x0032   200   200   000    Old_age   Always       -       24
193 Load_Cycle_Count        0x0032   169   169   000    Old_age   Always       -       94711
194 Temperature_Celsius     0x0022   110   110   000    Old_age   Always       -       40
196 Reallocated_Event_Count 0x0032   200   200   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0032   200   200   000    Old_age   Always       -       17
198 Offline_Uncorrectable   0x0030   200   200   000    Old_age   Offline      -       3
199 UDMA_CRC_Error_Count    0x0032   200   200   000    Old_age   Always       -       0
200 Multi_Zone_Error_Rate   0x0008   200   200   000    Old_age   Offline      -       10


So i used ddrescue to clone the disk to another disk (not image). That went through with only a few errors and errsize of less than 1 MB and reasonable speed (~130MB/s).
But unfortunately the cloned disk shows empty. What would be the best option to recover the data?

[pcimage]

Was it from a "MyBook" enclosure?

[lcoughey]

Agree with pcimage, probably encrypted.

[fzabkar]

Can you show us sector 0 of the cloned drive?

sudo dd count=1 bs=512 if=/dev/ice of=sector0.bin

... where /dev/ice is you cloned or patient drive.

[sebr]

The disk is not from a MyBook enclosure. It was connected as an internal drive to the motherboard controller.

Here is the requested file: http://filebin.ca/2tEKyIorVjCV/sector0.bin

[pcn]

mbr not encrypted, try tools like testdisk, dmde, r-studio to get your data back.

good look!

[fzabkar]

Can you show us the Partitions window in DMDE?

https://dmde.com/‎

[helpless]

you may have cloned the wrong drive

[sebr]

I haven't cloned the wrong drive.
Currently I am running a scan of r-studio (with default options) on the cloned disk. The NTFS partition showed up.
Before I ran testdisk and used it to recover (copy) some random files which completed successfully.
Let's see what r-studio can do once the scan is completed.

Attachments